Overview

overview

10

Static

static

MAT_BAO-Do...pt.exe

windows7_x64

3

MAT_BAO-Do...pt.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 22:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MAT_BAO-Document#20200627.ppt.exe

  • Size

    616KB

  • MD5

    9ec80f6e5410947c65a4b22a74eea652

  • SHA1

    5267449fd604844553526e4509a2f494537589af

  • SHA256

    91790ae3ca023feece6f78ea40830638f98b17469ddaed3e8184266f85141574

  • SHA512

    b5ae3ad60d9083b9e0e4dd42d65319b0266102f24f10ca9bcecacea6d77f98cab264a69d872423957fbea4ba7b5b579304d595b087cd8d967e8e7896272ac35f

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
    "C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sGSyzwcjNsGTxX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33CE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1708
    • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
      "{path}"
      2⤵
        PID:1196
      • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
        "{path}"
        2⤵
          PID:2012
        • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
          "{path}"
          2⤵
            PID:2008
          • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
            "{path}"
            2⤵
              PID:1396
            • C:\Users\Admin\AppData\Local\Temp\MAT_BAO-Document#20200627.ppt.exe
              "{path}"
              2⤵
                PID:1888

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp33CE.tmp
              Filesize

              1KB

              MD5

              69d0c08498ffadd743ce55e7859a1842

              SHA1

              d2552e62480e922b995da2caae7d7431dcea1943

              SHA256

              62a439ec0373c0d9c913bc0466b8f549b334f95338fcc1d0fbc045a44185dcf6

              SHA512

              35cb84ee176d78697e04d87044bf9c4c008e0d65663b667c51642ad3444cefecd560533c306b4583da01e958bbbc5649d1515381f7b9e0340e07fc8c60a335f7

              Download Submit

            • memory/1420-54-0x00000000003D0000-0x0000000000470000-memory.dmp

              Filesize

              640KB

              Download

            • memory/1420-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1420-56-0x00000000004D0000-0x00000000004D8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1420-57-0x0000000001E30000-0x0000000001E84000-memory.dmp

              Filesize

              336KB

              Download

            • memory/1708-58-0x0000000000000000-mapping.dmp

              Download